I have a folder called _secure in which I have a .htaccess file that denies all access to the _secure folder. Within the _secure folder I also have a swf file. I'm using PHP to retrieve the secured swf file and show it if the user is logged in. For some reason my code bellow doen't seem to work. I would appreciate any help.

$filename = $_GET['filename'];
$dir = '_secure/';

if ( user_logged_in() ) {
download_file( $filename, $dir );
} else {
header("HTTP/1.1 404 Not Found"); // dead end
}

function download_file( $fname, $path) {
$fpath = $path.$fname; // absolute path to file
$fsize = filesize( $fpath ); // size of file

header('Content-Type: application/x-shockwave-flash');
$content = file_get_contents($fpath);
echo $content;
}